fix(platform): address round 2 review findings

docs/tests/web/platform-onboarding-forms.md

@@ -18,14 +18,15 @@ non-secret values and show actionable errors. All state-changing browser operati
 MockMvc drives the production controllers, Bean Validation, Thymeleaf rendering, Spring Security filter chain, JPA
 services, and PostgreSQL 18.4. SMTP is replaced only at its network adapter. The tests inspect rendered status,
 buttons, warnings, validation messages, password non-retention, CSRF denial, ordered deferral navigation, and the
-failed-probe response while verifying that activation remains unavailable.
+failed-probe response while verifying that activation remains unavailable and raw adapter diagnostics are absent.
 
 ## Hand-derived expected result
 
 Successful bootstrap lands on `/admin/smtp?onboarding`. A saved draft shows Test but not Activate; a successful test
 shows Activate; activation clears the restricted warning. Deferral exposes warnings one through five in order, Back
 and Configure on every screen, and Finish only on screen five. Invalid data returns HTTP 200 with field/global errors
-and no submitted password. A failed SMTP probe displays its safe error and leaves the draft untested.
+and no submitted password. A failed SMTP probe displays fixed operator guidance and leaves the draft untested without
+rendering the adapter's diagnostic.
 
 ## RED
 
@@ -89,5 +90,5 @@ PostgreSQL: 18.4
 ## External-test boundaries
 
 The SMTP adapter is in-memory here, so this does not prove external Mailpit/server interoperability. MockMvc is not a
-real browser or accessibility run. The test exposes only the adapter's safe failure message fixture and never a raw
-password, integration secret, or activation bearer token.
+real browser or accessibility run. The test uses a non-secret diagnostic fixture only to prove that raw adapter text
+is absent; it never exposes a password, integration secret, or activation bearer token.